2026-07-11
- threat intel
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Version 8.14.0 of the jscrambler npm package contained a malicious preinstall hook that silently deployed a Rust-based infostealer on Windows, macOS, and Linux systems during installation. The package required no manual import or command line invocation to execute the malware. Socket security detected the compromised release approximately six minutes after its publication on July 11, 2026.
Why it matters: Developers and organizations using jscrambler are at immediate risk of information theft from their build environments; this requires urgent action to audit installations, identify compromised systems, and upgrade to a patched version.
- threat intel
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
Cybersecurity researchers documented sustained cyber espionage campaigns targeting Pakistani law enforcement agencies, particularly the Balochistan Police, attributed to China- and India-aligned threat actors between February 2024 and April 2026. Attackers compromised servers hosting web applications that manage police and citizen data, including criminal records and related information.
Why it matters: Pakistani law enforcement and any organization sharing data with these agencies faces exposure of sensitive criminal records and citizen information; practitioners should review access logs and assess whether their systems connect to these compromised platforms.
- threat intel
Ghost Accounts Abuse GitHub API in Mass Recon Campaign
Threat actors are using ghost accounts, which are dormant or fake GitHub profiles, to conduct reconnaissance against GitHub organizations by systematically mapping repositories and members through API calls. These mass recon campaigns aim to gather intelligence on potential targets before launching follow-up attacks.
Why it matters: Development teams and organizations hosting code on GitHub face increased reconnaissance risk from attackers mapping their infrastructure; defenders should monitor for unusual API access patterns and review account permissions to detect early-stage targeting.
- threat intel
Australia warns of global campaign targeting vulnerable CMS platforms
The Australian Cyber Security Centre (ACSC) alerted organizations to an active global campaign exploiting vulnerabilities in content management systems and their plugins. The campaign targets organizations running outdated or unpatched CMS deployments across multiple sectors.
Why it matters: Organizations running CMS platforms face immediate compromise risk if running vulnerable versions; practitioners should audit deployed CMS instances, apply patches promptly, and monitor for signs of exploitation.
- ransomware
Ransomware negotiator who conspired with BlackCat threat actors sentenced to 70 months in prison
A former ransomware negotiator employed by DigitalMint has been sentenced to 70 months in prison for conspiring with BlackCat threat actors. The negotiator provided BlackCat with inside information about victims' defense strategies, enabling the group to extort the companies he was hired to protect. This represents the third co-conspirator in the scheme to face sentencing.
Why it matters: Negotiators and insiders with knowledge of victim response plans pose a critical supply chain risk; organizations must implement access controls and monitoring for personnel with visibility into crisis strategies and victim defenses.
- breaches incidents
TikTok class action alleges data breach affected 2.4B users
A California resident filed a class action lawsuit against TikTok on June 11, 2026, claiming a data breach exposed personal data of more than 2.4 billion users globally. The complaint alleges TikTok stored unencrypted data and failed to implement basic security measures.
Why it matters: TikTok users and organizations handling user data face exposure risk; practitioners should monitor the litigation outcome and assess whether TikTok's security posture requires changes to data handling policies.
- ai security
AI Found a Root Bug in Linux That Everyone Missed for 15 Years
A machine learning system identified a previously undetected vulnerability in the Linux kernel that had existed for 15 years without discovery by human developers. The article also mentions Pentagon recruitment efforts for amateur hackers and a Flock license plate reader misidentification incident.
Why it matters: Linux maintainers and system administrators need to assess whether this vulnerability affects their deployed systems and apply patches when available; security researchers should evaluate how AI tooling can complement traditional code review processes to surface overlooked bugs.
- vulnerabilities
Wireshark 4.6.7 Released
Wireshark 4.6.7 was released with fixes for 12 vulnerabilities and 16 bugs. The update addresses security issues and stability improvements across the packet analysis tool.
Why it matters: Network administrators and security analysts using Wireshark should apply this update to patch known vulnerabilities and reduce exposure to potential exploitation.
- ai security
'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets
Researchers demonstrated a technique called Ghostcommit that embeds prompt injection attacks within PNG image files to bypass AI code review tools and manipulate AI agents into extracting and exfiltrating repository secrets. The attack successfully evaded CodeRabbit and Bugbot, which do not process image files, then instructed a coding agent to read environment variable files and encode secrets as numeric values in source code.
Why it matters: Development teams using AI code reviewers and agents face a new attack surface where image files can bypass security controls and compromise sensitive credentials; this affects anyone deploying AI tools in their development workflows.
- breaches incidents
US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals
A CISA contractor employee accidentally uploaded exposed passwords to a publicly accessible GitHub repository, which a GitGuardian researcher discovered and reported in May. The incident revealed that CISA had to develop its incident response procedures in real time during the event rather than having them prepared in advance.
Why it matters: CISA and federal agencies relying on its contractors face credential exposure and operational risk when incident response playbooks are absent, requiring practitioners to ensure their own organizations have pre-built response procedures in place.
- vulnerabilitiesCVE-2024-27822CVE-2026-41264
Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit
Metasploit released new exploit modules for three vulnerabilities: FlowiseAI CSV Agent (CVE-2026-41264), an unauthenticated remote code execution flaw allowing attackers to upload malicious CSV files; macOS PackageKit (CVE-2024-27822), a privilege escalation vulnerability in ZSH environment handling; and Apache .htaccess persistence for Linux systems. The update also includes enhancements to FTP fingerprinting, library reloading, MCP Server tools, and certificate tracing functionality.
Why it matters: Security practitioners should review patches for Flowise versions 1.3.0 through 3.0.13 and macOS versions 14.4, 13.6.6, 12.7.4, and 11 or earlier, as these vulnerabilities enable unauthenticated remote code execution and local privilege escalation respectively.